Cookies aren't sent if secure flag set previously
See original GitHub issueI’m coming from this question: https://github.com/expressjs/cookie-session/issues/89, except that I use HTTPS when using production environment and HTTP when using development. Each time I test the application in production, the secure cookies are set, and when I try to test it again in development, the cookies are not sent (even though I tried to specifically set the secure flag as secure: process.env.NODE_ENV === 'production'
). I don’t want to set the secure flag to false on production, as I only need secure cookies there. Is there a way to get the cookies to be sent when using HTTP?
Issue Analytics
- State:
- Created 5 years ago
- Comments:7 (3 by maintainers)
Top Results From Across the Web
TLS cookie without secure flag set
If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within...
Read more >Is it imporant that a cookie should have secure flag set if ...
The secure flag tells the browsers to only send a cookie if the request is being made over HTTPS.
Read more >Secure Cookie Attribute
The purpose of the secure attribute is to prevent cookies from being observed by unauthorized parties due to the transmission of the cookie...
Read more >Cookie Security Flags | Learn AppSec
The Secure flag specifies that the cookie may only be transmitted using HTTPS connections (SSL/TLS encryption) and never sent in clear text. If...
Read more >Cookie lack Secure flag - Knowledge Base - Detectify
When a cookie does not have the Secure-flag set, it will be sent in every request over both HTTP and HTTPS. Even if...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Okay, I just figured it out: if I use different names for the cookies depending on the environment, it will work on both HTTPS and HTTP.
Would it be possible to use different session cookies when using HTTP, so that it doesn’t try to get the secured ones?